Code and Theory
Associate Director, Security & Compliance (US)
New York, New York, United States · Director
Sponsorship not specified$140k-$175kDetected 27 days ago
AWSGCPAzureCloud PlatformsCI/CDAI OrchestrationIncident ResponseComplianceHIPAALeadershipCommunicationCollaboration
About the role
- We pride ourselves on not only solving consumer and business problems, but also helping to establish new capabilities for our clients.
- With a global client roster of Fortune 100s and start-ups alike, we crave the hardest problems to solve.
- With a remote-first approach to our people, we have teams distributed across North America, South America, Europe, and Asia.
Responsibilities
- Lead our security program across SaaS products and client projects, setting strategy, priorities, and measurable outcomes
- Lead SOC 2 Type II, ISO 27001, and ISO 42001 readiness and ongoing compliance, including control design, evidence processes, and auditor coordination. Own ISMS and AI governance documentation and oversight
- Lead privacy governance and operational practices, ensuring compliance with applicable requirements including HIPAA, GDPR, and CCPA/CPRA, and addressing data handling, contractual privacy terms, and privacy by design expectations
- Partner with delivery teams to embed security and privacy into how we build, with clear expectations, practical review gates, and patterns for common risks (identity, access, data handling, multi-tenancy, logging, and auditability)
- Lead vendor security reviews, including due diligence for critical providers, remediation tracking, and ongoing monitoring
- Support customer assurance efforts including security questionnaires, RFPs, client security reviews, and maintaining trust artifacts and standard responses
- Maintain an incident response program (playbooks, escalation, exercises) and drive post incident improvements
- Build a security and privacy culture through clear guidance, lightweight training, and day to day partnership with teams
- Experience building security and privacy processes that work in real delivery environments
Requirements
- 8+ years of progressive experience in information security, including leadership in SaaS and/or professional services environments
- Strong understanding of modern application and cloud security fundamentals (identity and access, encryption and key management, logging and monitoring, vulnerability management)
- Strong working knowledge of privacy requirements and practices, including HIPAA, GDPR, and CCPA/CPRA, and experience operationalizing privacy controls in product and client delivery contexts
- Comfort operating across a geographically dispersed organization and coordinating work across time zones
- Experience in an agency or consulting environment supporting multiple client projects in parallel
- Experience supporting AI-enabled products and data flows, including model and data risk considerations and familiarity with ISO 42001
- Expertise in at least one major cloud platform (GCP, AWS, or Azure) and common SaaS security patterns
- Experience with security monitoring, incident response, and vulnerability management programs in production environments
- Hands-on experience with security tooling across CI/CD, cloud infrastructure, vulnerability scanning, and logging and monitoring workflows
Skills
- The Machine is Stagwell's AI orchestration platform powering creative and strategic work across the Stagwell network.
- from tech to CPG, financial services to travel & hospitality, government and education to media and publishing.
- The Code and Theory network comprises nearly 2,000 people with 50% engineers and 50% creative talent.
- Actual compensation is influenced by a wide array of factors including but not limited to skill set, level of experience, and location.
Compensation
- The target range of base compensation for this role is $140,000 - $175,000.
Company info
- Born in 2001, Code and Theory is a digital-first creative agency that sits at the center of creativity and technology.
- The Code and Theory global network of agencies is growing and includes Kettle, Instrument, Left Field Labs, Mediacurrent, Rhythm, and TrueLogic.
- Striving never to be pigeonholed, we work across every major category: from tech to CPG, financial services to travel & hospitality, government and education to media and publishing.
- We value the collaboration with our client partners, including but not limited to Adidas, Amazon, Con Edison, Diageo, EY, J.P. Morgan Chase, Lenovo, Marriott, Mars, Microsoft, Thomson Reuters, and TikTok.
- We're always on the lookout for smart, driven, and forward-thinking people to join our team.
- The target range of base compensation for this role is $140,000 - $175,000.
Apply directly at Code and Theory →Create a free account for alerts like thisView Code and Theory immigration profile
This listing is sourced directly from Code and Theory's careers page and normalized into a canonical job model.